CVEs published February 28, 2023
113 CVEs were published on February 28, 2023: 10 critical, 48 high.
- Published
- 113
- Critical
- 10
- High
- 48
- Medium
- 47
- Low
- 1
- Unrated
- 7
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- 32
- Android
- 15
- joomunited WP Meta SEO
- 6
- OpenCATS
- 4
- Active IQ Unified Manager for VMware vSphere, Linux, and Mi…
- 2
- Dell PowerScale OneFS
- 2
- Trusted Computing Group TPM2.0
- 2
- ABB Relion protection relays - 611 series · ABB Relion p… +9
- 1
- api-platform core · api-platform/core
- 1
- AutomatorWP
- 1
Critical 10
- CVE-2023-22752Unauthenticated Stack-Based Buffer Overflow Vulnerabilities in the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22751Unauthenticated Stack-Based Buffer Overflow Vulnerabilities in the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-0511AM Java Policy Agent path traversalForgeRock Access Management Java Policy Agent
- CVE-2023-0339AM Web Policy Agent path traversalForgeRock Access Management Web Policy Agent
- CVE-2023-22750Multiple Unauthenticated Command Injections in the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22749Multiple Unauthenticated Command Injections in the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22748Multiple Unauthenticated Command Injections in the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22747Multiple Unauthenticated Command Injections in the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-20946In onStart of BluetoothSwitchPreferenceController.java, there is a possible permission bypass due to a confused deputy.Android
- CVE-2023-27372SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled.
High 48
- CVE-2023-25575Secured properties in API Platform Core may be accessible within collectionsapi-platform core · api-platform/core
- CVE-2022-41723Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/netGo standard library net/http · golang.org/x/net/http2 +3
- CVE-2023-22774Authenticated Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Deletion.Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22773Authenticated Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Deletion.Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22770Authenticated Remote Command Execution in the ArubaOS Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22769Authenticated Remote Command Execution in the ArubaOS Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22768Authenticated Remote Command Execution in the ArubaOS Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22767Authenticated Remote Command Execution in the ArubaOS Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22766Authenticated Remote Command Execution in the ArubaOS Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22765Authenticated Remote Command Execution in the ArubaOS Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22764Authenticated Remote Command Execution in the ArubaOS Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22763Authenticated Remote Command Execution in the ArubaOS Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22762Authenticated Remote Command Execution in the ArubaOS Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22761Authenticated Remote Command Execution in ArubaOS Web-based Management InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22760Authenticated Remote Command Execution in ArubaOS Web-based Management InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22759Authenticated Remote Command Execution in ArubaOS Web-based Management InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22758Authenticated Remote Command Execution in ArubaOS Web-based Management InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22757Unauthenticated Buffer Overflow Vulnerabilities in ArubaOS ProcessesHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22756Unauthenticated Buffer Overflow Vulnerabilities in ArubaOS ProcessesHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22755Unauthenticated Buffer Overflow Vulnerabilities in ArubaOS ProcessesHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22754Unauthenticated Buffer Overflow Vulnerabilities in ArubaOS ProcessesHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22753Unauthenticated Buffer Overflow Vulnerabilities in ArubaOS ProcessesHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-25807DataEase dashboard has a stored XSS vulnerabilitydataease
- CVE-2023-0461Use-after-free vulnerability in the Linux KernelLinux Kernel
- CVE-2023-24419WordPress Formidable Forms Plugin <= 5.5.6 is vulnerable to Cross Site Request Forgery (CSRF)Strategy11 Form Builder Team Formidable Forms
- CVE-2023-26105All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function.utilities
- CVE-2022-4895Man-in-the-middle attack Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center AnalyzerHitachi Infrastructure Analytics Advisor · Hitachi Ops Cent…
- CVE-2022-3884Directory Permission Vulnerability in Hitachi Ops Center AnalyzerHitachi Ops Center Analyzer
- CVE-2015-10086OpenCycleCompass server-php login.php sql injectionOpenCycleCompass server-php
- CVE-2022-47075An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name paramet
- CVE-2022-47076An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to view sensitive information via DisplayParallelLogData.aspx
- CVE-2023-20933In several functions of MediaCodec.cpp, there is a possible way to corrupt memory due to a use after free.Android
- CVE-2023-20934In resolveAttributionSource of ServiceUtilities.cpp, there is a possible way to disable the microphone privacy indicator due to a permissionAndroid
- CVE-2023-20937In several functions of the Android Linux kernel, there is a possible way to corrupt memory due to a use after free.Android
- CVE-2023-20938In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input validation.Android
- CVE-2023-20939In multiple functions of looper_backed_event_loop.cpp, there is a possible way to corrupt memory due to improper locking.Android
- CVE-2023-20940In the Android operating system, there is a possible way to replace a boot partition due to improperly used crypto.Android
- CVE-2023-20943In clearApplicationUserData of ActivityManagerService.java, there is a possible way to remove system files due to a path traversal error.Android
- CVE-2023-20944In run of ChooseTypeAndAccountActivity.java, there is a possible escalation of privilege due to unsafe deserialization.Android
- CVE-2023-20945In phNciNfc_MfCreateXchgDataHdr of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2023-20948In dropFramesUntilIframe of AAVCAssembler.cpp, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2023-22995In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device
- CVE-2023-25264An issue was discovered in Docmosis Tornado prior to version 2.9.5.
- CVE-2023-25265Docmosis Tornado <= 2.9.4 is vulnerable to Directory Traversal leading to the disclosure of arbitrary content on the file system.
- CVE-2023-25266An issue was discovered in Docmosis Tornado prior to version 2.9.5.
- CVE-2023-26255An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira.
- CVE-2023-26256An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira.
- CVE-2023-27320Sudo before 1.9.13p2 has a double free in the per-command chroot feature.
Medium, low and unrated 55
- CVE-2023-0847 The Sub-IoT implementation of the DASH 7 Alliance protocol has a vulnerability that can lead to an out-of-bounds write prior to implementatSub-IoT DASH 7 Alliance Protocol stack implementation
- CVE-2023-1100SourceCodester Online Catering Reservation System POST Parameter add_message.php sql injectionSourceCodester Online Catering Reservation System
- CVE-2023-1099SourceCodester Online Student Management System edit-class-detail.php sql injectionSourceCodester Online Student Management System
- CVE-2023-1065This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfSnyk Kubernetes Monitor
- CVE-2023-1017TPM2.0 vulnerable to out-of-bounds writeTrusted Computing Group TPM2.0
- CVE-2023-1018TPM2.0 vulnerable to out-of-bounds read Trusted Computing Group TPM2.0
- CVE-2022-41727Denial of service via crafted TIFF image in golang.org/x/image/tiffgolang.org/x/image/tiff · golang.org/x/image
- CVE-2022-41724Panic on large handshake records in crypto/tlsGo standard library crypto/tls · stdlib
- CVE-2022-41725Excessive resource consumption in mime/multipartGo standard library mime/multipart · stdlib
- CVE-2022-41722Path traversal on Windows in path/filepathGo standard library path/filepath · stdlib
- CVE-2023-22778Authenticated Stored Cross-Site ScriptingHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22777Authenticated Information Disclosure in ArubaOS Web-based Management InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22776Authenticated Remote Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File ReadHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22775Authenticated Sensitive Information Disclosure in ArubaOS Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22772Authenticated Path Traversal in ArubaOS Web-based Management Interface Allows for Arbitrary File DeletionHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-22771Insufficient Session Expiration in ArubaOS Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…
- CVE-2023-23689 Dell PowerScale nodes A200, A2000, H400, H500, H600, H5600, F800, F810 integrated hardware management software contains an uncontrolled resDell PowerScale OneFS
- CVE-2023-25540 Dell PowerScale OneFS 9.4.0.x contains an incorrect default permissions vulnerability.Dell PowerScale OneFS
- CVE-2022-47179WordPress OWM Weather Plugin <= 5.6.11 is vulnerable to Cross Site Request Forgery (CSRF)Uwe Jacobs OWM Weather
- CVE-2022-47612WordPress Participants Database Plugin <= 2.4.5 is vulnerable to Cross Site Request Forgery (CSRF)Roland Barker, xnau webdesign Participants Database
- CVE-2023-23865WordPress Stripe Payments For WooCommerce by Checkout Plugin <= 1.4.10 is vulnerable to Cross Site Request Forgery (CSRF)Stripe Payments For WooCommerce by Checkout Plugins
- CVE-2023-23983WordPress Responsive Vertical Icon Menu Plugin <= 1.5.8 is vulnerable to Cross Site Request Forgery (CSRF)wpdevart Responsive Vertical Icon Menu
- CVE-2023-26281IBM HTTP Server denial of serviceIBM HTTP Server
- CVE-2023-23992WordPress AutomatorWP Plugin <= 2.5.0 is vulnerable to Cross Site Request Forgery (CSRF)AutomatorWP
- CVE-2022-43459WordPress Forms by CaptainForm Plugin <= 2.5.3 is vulnerable to Cross Site Request Forgery (CSRF)Forms by CaptainForm – Form Builder for WordPress
- CVE-2023-1022WP Meta SEO <= 4.5.3 - Missing Authorization in 'wpmsGGSaveInformation'joomunited WP Meta SEO
- CVE-2023-1023WP Meta SEO <= 4.5.3 - Missing Authorization in 'saveSitemapSettings'joomunited WP Meta SEO
- CVE-2023-1024WP Meta SEO <= 4.5.3 - Missing Authorization in 'regenerateSitemaps'joomunited WP Meta SEO
- CVE-2023-1026WP Meta SEO <= 4.5.3 - Missing Authorization in 'listPostsCategory'joomunited WP Meta SEO
- CVE-2023-1027WP Meta SEO <= 4.5.3 - Missing Authorization in 'checkAllCategoryInSitemap'joomunited WP Meta SEO
- CVE-2023-1028WP Meta SEO <= 4.5.3 - Cross-Site Request Forgery via 'setIgnore'joomunited WP Meta SEO
- CVE-2023-1080GN Publisher <= 1.5.5 - Reflected Cross-Site Scriptinggnpublisher GN Publisher: Google News Compatible RSS Feeds
- CVE-2021-22283MMS File Transfer Vulnerability impact on Distribution Automation productsABB Relion protection relays - 611 series · ABB Relion p… +9
- CVE-2020-36652File and Directory Permissions Vulnerability in Hitachi Automation Director, Hitachi Infrastructure Analytics Advisor, Hitachi Ops CenterHitachi Automation Director · Hitachi Infrastructure Ana… +3
- CVE-2022-20455In addAutomaticZenRule of ZenModeHelper.java, there is a possible persistent denial of service due to resource exhaustion.Android
- CVE-2022-20481In multiple files, there is a possible way to preserve WiFi settings due to residual data after a reset.Android
- CVE-2022-20551In createTrack of AudioFlinger.cpp, there is a possible way to record audio without a privacy indicator due to a logic error in the code.Android
- CVE-2022-23239Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a vulnerability whichActive IQ Unified Manager for VMware vSphere, Linux, and Mi…
- CVE-2022-23240Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a vulnerability whichActive IQ Unified Manager for VMware vSphere, Linux, and Mi…
- CVE-2022-38220An XSS vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.1 that may allow remote injection of arbitrary w
- CVE-2023-1081Cross-site Scripting (XSS) - Stored in microweber/microwebermicroweber/microweber
- CVE-2023-1095In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object.Linux kernel netfilter subsystem.
- CVE-2023-20857VMware Workspace ONE Content contains a passcode bypass vulnerability.VMware Workspace ONE Content
- CVE-2023-20932In onCreatePreferences of EditInfoFragment.java, there is a possible way to read contacts belonging to other users due to improper input valAndroid
- CVE-2023-22996In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with p
- CVE-2023-22997In the Linux kernel before 6.1.2, kernel/module/decompress.c misinterprets the module_get_next_page return value (expects it to be NULL in t
- CVE-2023-22998In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects
- CVE-2023-22999In the Linux kernel before 5.16.3, drivers/usb/dwc3/dwc3-qcom.c misinterprets the dwc3_qcom_create_urs_usb_platdev return value (expects it
- CVE-2023-25431An issue was discovered in Online Reviewer Management System v1.0.
- CVE-2023-25432An issue was discovered in Online Reviewer Management System v1.0.
- CVE-2023-27292An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters.OpenCATS
- CVE-2023-27293Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer OpenCATS
- CVE-2023-27294Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted account to submit mOpenCATS
- CVE-2023-27295Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests.OpenCATS
- CVE-2023-27371GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postp